Awesome
LLOLBAS (Local LOLBAS)
llolbas
is a repo containing a localized and off-line version of the ever
popular Living Off the Land Binaries and Scripts
(LOLBAS) project.
Why?
We noticed two problems when using tooling such as GTFO bins and LOLBAS:
- They are online
- They have every binary imaginable.
For point 1, this becomes an issue for engagements where a red-teamer or penetration tester may not have access to the outside world. Alternatively, the domain for LOLBAS may be blocked, detected, or just otherwise down.
In point 2, we see while it is nice to have an entire listing of every binary which could be used to download, upload, execute, or what have you, in the enumeration phase, you really only care about what accomplishes your goal. For this reason, we built in functionality to allow for curating of the entries in the LOLBAS database based on what binaries actually exist on your target machine. Nothing too crazy, but damn if it ain't helpful.
Disclaimer: Some of the code/scripts/script examples will still need to be called for. This is something we are looking to integrate later on.
How?
Using the power of one of our included ingestors, you can throw one of those bad boys on a target server and download the outputted base64 encoded JSON file. Using the instructions below, you can then start up your Local LOLBAS instance and begin browsing away while not on the target.
Note: The digestor will begin a Flask server on a local port of choosing or default 5000.
Where?
Currently we are only hosting the project on GitHub however, there is talk to make this a pypi/pip package through one of the pip repositories. Since all the assets are primarily in a huge dictionary, there is no tossing around dependencies and downloading from other repositories.
Getting Started
llolbas
requires Python 3.6+. Python 2 is not supported.
llolbas
can be installed as a module using pip
and the requirements.txt file
in the repository or by directly calling upon the git repo using the git
modifier for pip.
Installing Via Repo
First Git clone the repository:
git clone https://github.com/AZSERG/LLOLBAS.git
For users not planning on doing development work, just use the basic requirements.txt:
pip install --requirement ./requirements.txt
Installing Via Git + pip
In one simple step, you can use pip to pull and install a GitHub repository:
pip install git+https://github.com/AZSURGE/LLOLBAS.git
Usage and Examples
llolbas
can then be ran directly via the command line like so:
llolbas is a local server and digester for LOLBAS.
llolbas is a command line program which allows a user
to not only run a local instance of the hit internet
resource LOLBAS, but also be able to digest output
from the included ingestor to allow for curated listing
of binaries which exist within a target Windows
computer.
EXIT STATUS
This utility exits with one of the following values:
0 Execution completed successfully.
>0 An error occurred.
Usage:
llolbas serve [options]
llolbas serve (-p PORT | --port=PORT)
llolbas serve (-d FILE | --digest=FILE)
llolbas (-h | --help)
Options
-h --help Show this message.
-d FILE --digest=FILE If specified, use file
from one of the ingestors to
curate the LOLBAS served
output.
-p PORT --port=PORT Specify the port to start
the flask server on. [default: 5000].
Sample Output
The ingestor scripts should have no output. Debug mode can be turned on however, if you wish to have some sort of verbosity. The output from these should be a large base64 encoded JSON formatted string either written to a file or stdout.
Once llolbas
is ran, we see the output from flask shown like so:
* Serving Flask app "llolbas.llolbas" (lazy loading)
* Environment: production
WARNING: This is a development server. Do not use it in a production deployment.
Use a production WSGI server instead.
* Debug mode: off
* Running on http://127.0.0.1:5000/ (Press CTRL+C to quit)
Browsing to the website you are met with the following screen:
Clicking on an application you find will look like the following:
Disclaimer
This tool is only for testing and academic purposes and can only be used where strict consent has been given. Do not use it for illegal purposes! It is the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this tool and software.
Credit
The credit for all the LOLBAS content goes to the LOLBAS-Project.
Contributing
We welcome contributions! Please see CONTRIBUTING.md
for
details.
License
This project is licensed under the GPLv3 License - see the LICENSE file for details